N8n-io vulnerabilities
206 CVEs and advisories name N8n-io as an affected vendor, 1 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-25115n8n is vulnerable to Python sandbox escape
- CVE-2026-25056n8n Arbitrary File Write leading to RCE in n8n Merge Node
- CVE-2026-25055n8n Arbitrary File Write on Remote Systems via SSH Node
- CVE-2026-25054n8n is Vulnerable to Stored Cross-Site Scripting via Markdown Rendering in Workflow UI
- CVE-2026-25053n8n is Vulnerable to OS Command Injection in Git Node
- CVE-2026-25052n8n Improper File Access Controls Allow Arbitrary File Read by Authenticated Users
- CVE-2026-25051n8n Improper CSP Enforcement in Webhook Responses May Allow Stored XSS
- CVE-2025-61917n8n Unsafe Buffer Allocation Allows In-Process Memory Disclosure in Task Runner
- CVE-2026-25049n8n Has an Expression Escape Vulnerability Leading to RCE
- CVE-2025-68949n8n has a Webhook Node IP Whitelist Bypass via Partial String Matching
- CVE-2026-21894n8n's Missing Stripe-Signature Verification Allows Unauthenticated Forged Webhooks
- CVE-2026-21877n8n is vulnerable to Remote Code Execution via Arbitrary File Write
- CVE-2026-21858n8n Vulnerable to Unauthenticated File Access via Improper Webhook Request Handling
- CVE-2025-68697Self-hosted n8n has Legacy Code node that enables arbitrary file read/write
- CVE-2025-68668n8n Vulnerable to Arbitrary Command Execution in Pyodide based Python Code Node
- CVE-2025-61914n8n's Possible Stored XSS in "Respond to Webhook" Node May Execute Outside iframe Sandbox
- CVE-2025-68613n8n Vulnerable to Remote Code Execution via Expression Injection
- CVE-2025-65964n8n Vulnerable to Remote Code Execution via Git Node Custom Pre-Commit Hook
- CVE-2025-62726n8n Vulnerable to Remote Code Execution via Git Node Pre-Commit Hook
- CVE-2025-58177n8n stored cross-site scripting in LangChain Chat Trigger node initialMessages parameter
- CVE-2025-57749n8n has a symlink traversal vulnerability in "Read/Write File" node allows access to restricted files
- CVE-2025-52478Stored XSS in n8n Form Trigger allows Account Takeover via injected iframe and video/source
- CVE-2025-52554n8n Improper Authorization in Workflow Execution Stop Endpoint Allows Terminating Other Users’ Workflows
- CVE-2025-49595n8n Vulnerable to Denial of Service via Malformed Binary Data Requests
- CVE-2025-49592n8n Login Flow has Open Redirect Vulnerability
- CVE-2025-46343n8n Vulnerable to Stored XSS through Attachments View Endpoint